Archive
January 2021
Vulnerabilities first published in this month (UTC), newest first.
1,527 results · Feed
-
Unscored —
Inappropriate implementation in cryptohome in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker…
-
Unscored —
Inappropriate implementation in filesystem in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker…
-
Unscored —
Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the ren…
-
Critical 9.6CVE-2020-16017 Exploited
Use after free in CefSharp
Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
KEV Nov 3, 2021 -
Unscored —
Inappropriate implementation in base in Google Chrome prior to 86.0.4240.193 allowed a remote attacker who had compromi…
-
Unscored —
Insufficient data validation in WASM in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially ex…
-
Unscored —
Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the render…
-
Unscored —CVE-2020-16012 Public exploit
Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak c…
-
High 8.8CVE-2020-16013 Exploited
Inappropriate implementation in V8 in CefSharp
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
KEV Nov 3, 2021 -
Unscored —
A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-base…
-
Unscored —
An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.
-
Unscored —
The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that …
-
Unscored —
The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that …
-
Unscored —
Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4). The NDN-210 has a web administration panel which …
-
Unscored —
Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCrit…
-
Unscored —
Element OS versions prior to 1.8P1 and 12.2 are susceptible to a vulnerability that could allow an unauthenticated remo…
-
Unscored —
Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 HL7 v2.x injection vulnerabilities exist in the aff…
-
Unscored —
Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 A stored cross-site scripting (XSS) vulnerability e…
-
Unscored —
In Marvell QConvergeConsole GUI <= 5.5.0.74, credentials are stored in cleartext in tomcat-users.xml. OS-level users on…
-
Unscored —
Marvell QConvergeConsole GUI <= 5.5.0.74 is affected by a path traversal vulnerability. The deleteEventLogFile method o…
-
Unscored —
NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which input data is not validated, which may lead t…
-
Unscored —
NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which it obtains a value from an untrusted source, …
-
Unscored —
NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which input data is not validated, which may lead t…
-
Unscored —
NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input offset is not validated, which may l…
-
Unscored —
NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input data length is not validated, which …
-
Unscored —
NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which a race condition may cause the vGPU plugin to…
-
Unscored —
NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and vGPU plugin, in which an input index …
-
Unscored —
NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input index is not validated, which may le…
-
Unscored —
NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and vGPU plugin, in which an input data s…
-
Unscored —
NVIDIA Virtual GPU Manager NVIDIA vGPU manager contains a vulnerability in the vGPU plugin in which it allows guests to…
-
Medium 4.3
IBM Engineering Requirements Quality Assistant On-Premises could allow an authenticated user to obtain sensitive inform…
-
Medium 5.4
IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability al…
-
Medium 5.4
IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability al…
-
Medium 5.4
IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability al…
-
Medium 5.7
IBM Security Verify Privilege Manager 10.8 is vulnerable to an XML External Entity Injection (XXE) attack when processi…
-
Unscored —CVE-2021-3111 Public exploit
The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.…
-
Critical 9.8
command_injection
This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js. The vulnerability is demonstrated with the following PoC:
-
Critical 9.8
Command Injection
This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function install(requestedModule).
-
High 8.1
Improper Control of Generation of Code ('Code Injection')
This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code execution.
-
Unscored —
Advanced Webhost Billing System 3.7.0 is affected by Cross Site Request Forgery (CSRF) attacks that can delete a contac…